# CVE-2021-28128: Strapi account takeover via unverified password change in admin panel

Source: https://junglewise.ai/threats/cve-2021-28128-strapi-account-takeover-via-unverified-password-change-in-admin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-10-06. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2021-28128 · Severity: low · CVSS 3.1 · Published 2021-10-06

Strapi, a popular open-source content management system, contains a flaw in its administrative interface that allows users to change their account password without providing their current one. If an attacker gains temporary access to a user's active web session—for example, through an unattended computer or a separate session-theft vulnerability—they can permanently take over the account by setting a new password. This could lead to a total loss of access for the legitimate user and unauthorized control over the website's content.

Technologies: [strapi (npm)](https://junglewise.ai/threats/technologies/strapi). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-28128 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-28128 being exploited in the wild.

**How severe is CVE-2021-28128?** Low severity, with a CVSS score of 3.1, published 6 October 2021.

**Which products and versions are affected?** strapi (npm) SEMVER:introduced=0,last_affected=3.6.0.

**Is there a fix for CVE-2021-28128?** A patch was published on 2021-04-22: Fixed in version 3.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-28128 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2021-28128?** Check whether you run strapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A weak password recovery/change mechanism exists in the Strapi admin panel through version 3.6.0. The application fails to require the 'current password' as a validation step during the password update process (CWE-640/CWE-620). An attacker who obtains a valid session token or physical access to an authenticated browser session can change the account password to a value of their choosing. This results in a full account takeover and persistent access, as the original user is locked out. The vulnerability is reachable via the network by any user with access to the admin panel.

## Affected products

- Strapi Strapi <= 3.6.0

## Identifiers

- CVE-2021-28128
- GHSA-37hx-4mcq-wc3h

## Timeline

- 2021-02-26: other: Vulnerability discovered
- 2021-03-08: disclosed: Reported to manufacturer
- 2021-04-22: patched: Fixed in version 3.6.0
- 2021-04-26: advisory: Public disclosure by SySS GmbH

## References

- [https://github.com/strapi/strapi/issues/9657](https://github.com/strapi/strapi/issues/9657)
- [https://github.com/strapi/strapi](https://github.com/strapi/strapi)
- [https://github.com/strapi/strapi/releases/tag/v3.6.0](https://github.com/strapi/strapi/releases/tag/v3.6.0)
- [https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-008.txt](https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-008.txt)

## Related threats

- [Strapi information disclosure via hidden attributes in admin API](https://junglewise.ai/threats/cve-2022-31367-strapi-information-disclosure-via-hidden-attributes-in-admin-api)
- [Strapi stored cross-site scripting in file upload](https://junglewise.ai/threats/cve-2022-29894-strapi-stored-cross-site-scripting-in-file-upload)
- [Strapi improper input validation in email templates](https://junglewise.ai/threats/cve-2020-13961-strapi-improper-input-validation-in-email-templates)
- [Strapi sensitive information disclosure in admin panel](https://junglewise.ai/threats/cve-2022-30618-strapi-sensitive-information-disclosure-in-admin-panel)
- [Strapi sensitive information disclosure in admin responses](https://junglewise.ai/threats/cve-2022-30617-strapi-sensitive-information-disclosure-in-admin-responses)